hooks_ct.c: bind-mount root to itself

Bind-mount container root into itself after entering user namespace,
since kernel v3.11-rc3.

Here is workaround for the following kernel commit:

 commit 5ff9d8a65ce80efb509ce4e8051394e9ed2cd942
 Author: Eric W. Biederman <ebiederm@xmission.com>
 Date:   Fri Mar 29 21:04:39 2013 -0700

    vfs: Lock in place mounts from more privileged users

    When creating a less privileged mount namespace or propogating mounts
    from a more privileged to a less privileged mount namespace lock the
    submounts so they may not be unmounted individually in the child mount
    namespace revealing what is under them.

    This enforces the reasonable expectation that it is not possible to
    see under a mount point.
    ...

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Acked-by: Kir Kolyshkin <kir@openvz.org>
hooks_ct: mount /proc and /sys before umounting old root

Here is workaround for the kernel commit:

 commit e51db73532955dc5eaba4235e62b74b460709d5b
 Author: Eric W. Biederman <ebiederm@xmission.com>
 Date:   Sat Mar 30 19:57:41 2013 -0700

    userns: Better restrictions on when proc and sysfs can be mounted

    Rely on the fact that another flavor of the filesystem is already
    mounted and do not rely on state in the user namespace.

    Verify that the mounted filesystem is not covered in any significant
    way.  I would love to verify that the previously mounted filesystem
    has no mounts on top but there are at least the directories
    /proc/sys/fs/binfmt_misc and /sys/fs/cgroup/ that exist explicitly
    for other filesystems to mount on top of.

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Acked-by: Kir Kolyshkin <kir@openvz.org>
Signed-off-by: Kir Kolyshkin <kir@openvz.org>